continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
480 Commits 1 Branch 190 Tags
cf8aa53c8dafa6b1cc0a0cc4dbfcb30b7e1333c2
Commit Graph

5 Commits

Author SHA1 Message Date
Jon Chery 38b51f3e6d feat(P4): regression-gate policies + docs (REQ-304..307) 
regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector,
cap-024-deck-structure — declarative mirrors of core/regression_verify.py
over capability-inventory JSON. The imperative regression_verify.py is kept
(drives CI gate); the policies are the declarative mirror (IDEATE I1 quality
improvement).

tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj.

docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol
section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine,
install, policy directory layout, 4 categories, severity convention),
schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10
Policy Authoring Standard, docs/METRICS.md (swappable engine narrative).

---ci---
project: acdl
phase: 4
milestone: v1.25
status: execute
phase_role: execution
requirements:
  covered: [REQ-304, REQ-305, REQ-306, REQ-307]
  partial: []
---/ci---
 2026-08-12 18:42:55 +00:00
Jon Chery 7f4b79593a feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303) 
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46),
forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports
CKV_AWS_7/33) over terraform show -json output.

meta/ policies (2): block-on-any-critical (declarative source of truth for
critical-block; confidence_signal hard-override stays as defense-in-depth,
D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj
KJ_REQUIRE_TAGGING_STANDARD, D-118).

scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges
Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips
gracefully when kj absent (D-120).

tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj),
test_run_platform_plan_json_policies.py (script-substring assertion, no skip).

---ci---
project: acdl
phase: 3
milestone: v1.25
status: execute
phase_role: execution
requirements:
  covered: [REQ-300, REQ-301, REQ-302, REQ-303]
  partial: []
---/ci---
 2026-08-12 18:29:34 +00:00
Jon Chery e6ee79402b feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299) 
contract/ policies (4): require-id-pattern, require-env-in-enum,
require-infrastructure-min-1, forbid-unknown-fields — declarative
mirrors of contract.schema.json constraints.

stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/
environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress
(v1.0 demo rule, now declarative), require-encryption-by-default (v1.8
D-encryption-default — S3 + EBS encryption config).

core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296)
+ post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's
return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults.
Policy evaluation never breaks the resolver (confidence signal decides gate).

tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj.
16 existing resolver tests unchanged.

---ci---
project: acdl
phase: 2
milestone: v1.25
status: execute
phase_role: execution
requirements:
  covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299]
  partial: []
---/ci---
 2026-08-12 18:25:18 +00:00
Jon Chery 51c3edf458 feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162) 
SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---
 2026-07-30 01:38:30 +00:00
Jon Chery 1fd37a2843 feat(P23): tagging standard + Wiz adapter + Kyverno adapter 
Phase 23 (v1.7) — tagging standards and security adapters.

* schemas/tagging-standard.json (D-054): canonical required-tags schema
  (acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
  rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
  (synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
  ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
  --external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
  PolicyCheckResult (engine: "wiz"); graceful degradation emits
  WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
  results to PolicyCheckResult (engine: "kyverno"); ready but inactive
  for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
  (13 tests); updated test_checkov_adapter.py to not expect the removed
  synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.

202 tests pass; CI pipeline OK (lint + test + check-only).

Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
  (data.get() on a list); fixed to dispatch on isinstance(data, list)
  before calling .get(). No spec change — bare-list handling is implied
  by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
  "skip") -> "skip"), not "error"; test expectation corrected. Added an
  explicit unknown-result-string test to cover the "error" fallback.

---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
 2026-07-22 20:00:46 +00:00